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Method And Safety System For A Displacement Device Of A Motor Vehicle 



Description 



The invention relates to a method and a safety system for a locking device for a motor 
vehicle according to the preamble of claim 1 . 

From the prior art it is known to use serial data protocols of a bus technology in the motor 
vehicle for data transfer between electronically controlled devices. Thus by way of 
example the individual body control devices are linked, such as the central body 
electronics, combination instruments and control devices in the doors. From the central 
body electronics, a central control device in the motor vehicle, trigger signals are 
generated more particularly for the central locking function and are transferred to the 
executing control devices by means of a serial data protocol. The locking function is 
thereby dependent on these trigger signals. 

Furthermore it is known in the event of a complete breakdown of the bus system to 
switch the door control devices over automatically into an emergency operating mode in 
order to enable the functions pertaining to safety which are dependent on being 
triggered. It has however been seen that even with a breakdown of one part of the 
electronics which are connected through the bus (central control device or further 
instruments of the motor vehicle connected thereto) important or even all functions of the 
displacement systems can be blocked because a failed electronics unit could no longer 
supply the data which was necessary to generate the trigger signals. Such emergency 
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operating modes for window lifters are l<nown for example from EP 1 060 922 A or DE 
199 28 101 C2. 

Furthermore the technical functioning of the displacement systems is dependent on the 
5 functional ability and reliability of the control devices. Breakdown situations which lead to 
a partial failure of the control electronics run the risk of generating parasitic resistances 
which clearly reduce insulation between two conductor paths of the electronics of the 
door control device. Parasitic resistances caused in this way can have values of some 
hundred ohms. If this resistance arises between a control connection of a power switch 
10 and a fixed potential, more particularly the battery voltage or the earth connection, then 
this can lead to undesired control of the power switch and consequently to an undesired 
adjustment of the displacement device. 

The breakdown of parts of the vehicle electrics, more particularly the bus system or the 
15 control device through crash effects can lead through the undesired displacement of the 
displacement device in the emergency accident situation to additional dangers. 

The object of the invention is to provide a method and system for safeguarding a locking 
device of a motor vehicle which enables the opening of the locking device in the event of 
20 a breakdown of parts of the system, and at the same time reduces the risk of automatic 
responses in a non-desired state or manual faulty functions. 

This is achieved through the safety system having the features of patent claim 1 and 
through the method having the features of patent claim 14 or patent claim 15. 
25 Advantageous further developments of the invention can be drawn from the sub-claims. 

According to this a safety system is provided for a locking device of a motor vehicle 
wherein a control device which is a constituent part of the safety system, has at least one 
power switch for controlling an electromechanical unit in the "blocking" state, also termed 
30 "safe" state, and which can additionally be influenced through a central control device. 
This blocking state differs from the locking states "unlocked" and "locked" of the locking 
device of the vehicle door. 
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If the electromechanical unit is in the "unlocked" state then the motor vehicle door can be 
opened manually both from outside and from inside the vehicle or the motor vehicle door 
is to be opened automatically by means of a motorised drive. 

5 

In the "locked" state the motor vehicle door is no longer to be opened from outside but 
furthermore all mechanical functions of the electromechanical unit are activated so that 
the motor vehicle door is to be opened from inside which is also possible as an extra aid 
from outside through a corresponding tool should the vehicle user have been 
10 accidentally locked out. 

In order to prevent theft of the vehicle the electromechanical units of the motor vehicle 
are moved into the "blocking" state. In the "blocking" state all mechanical functions of the 
electromechanical unit are deactivated so that the vehicle door cannot be opened by the 
15 auxiliary tool or from the inside of the vehicle no longer manually through the actuation of 
mechanical components of the electromechanical unit. 

These different states are caused through the electromechanical unit which produces at 
least the states "unlocked", "locked" and "blocking" through the supply of electrical 
20 energy by means of mechanical adjustments. The states deschbed can in principle be 
different for the relevant vehicle doors or also the boot flap of the motor vehicle. 

The states of all the locking units of one vehicle .are preferably tuned with each other 
through the central control device by means of serial data protocols. 

25 

For this a central control device is provided which has signal links, more particularly a 
serial bus connection to the control devices of the relevant door of the motor vehicle. 
These signal links enable data transfer to produce the desired states in that the 
electromechanical unit can be controlled through the central control device via the signal 
30 links. By way of example the signal links enable a data transfer to transmit the desired 
states from the central control device to the relevant control devices for controlling the 
local locking device. 
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Data transfer is in a sinnple case a signal, voltage or binary data assigned to the relevant 
situation. More complex links enable an improvement in the reliability of the transfer and 
the transfer of commands, status data and/or diagnosis data of the electromechanical 
unit or from operating elements. 

In order to secure this system the door control device is connected to the central control 
device through an electrical lead connection which is independent of the signal links. For 
the independence of this electrical lead connection it is necessary that the voltages or 
signals transferred through the signal links do not disturb this independent electrical lead 
connection. A particularly expedient simple design of the invention proposes that a 
separate conductor which is electrically insulated from the signal links is used as the 
independent electrical lead connection, 

A potential of a control connection of the previously mentioned power switch can be 
controlled by the central control device through this independent electrical lead 
connection for energising the electromechanical unit or a power connection of the control 
device which can be connected to the electromechanical unit. The control is preferably 
undertaken directly by connecting the control connection or power connection electrically 
and directly to the central control device through the independent electrical lead 
connection. Alternatively the potential of the relevant connection could also be controlled 
indirectly by the central control device by switching a further logic element, by way of 
example switch transistor in between the independent electrical lead and the relevant 
connection. 

Consequently the control is carried out with an additional release dependence through 
the independent electrical lead connection from the central electronics to the relevant 
local control devices whereby without this release a control of the electromechanical unit 
is not possible into the "blocking" state. 

According to a further advantageous embodiment of the invention the central control 
device only releases the control of the electromagnetic unit in the "blocking" direction 
when the functional capacity of the serial data transfer is ensured through the signal link, 
which can happen for example through a continuous status enquiry of all the control 
devices and central control devices involved. For this the central control device has 
advantageously an evaluation device which is designed for controlling the power 
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connection in dependence on a state or an emergency operation of tlie signal links. This 
evaluation device interrogates cyclically for example the junctions of a bus system of the 
signal links in order to check their functional ability and the functional ability of the signal 
links. More advantageously additional vehicle states are evaluated, more particularly the 
ignition state. A switched-off ignition is thereby a further condition for controlling the 
potential of the control connection. If at least one condition is not fulfilled, for example 
the failure of the serial data protocol as a result of physical actions in the event of a 
crash, the release condition is not fulfilled, i.e. this is set back so that the potential to the 
independent electrical lead connection is not controlled through the central control 
device. 

An advantageous development of the invention proposes that for control the potential 
can be switched to this independent electrical lead connection. Preferably the output of 
the central control device has for this switch process a low-resistance output which 
clearly reduces the tendency of this independent electrical lead connection to react 
sensitively to breakdown factors. A low-resistance output of this kind is achieved for 
example by using switch transistors which have in addition to the connection to the 
independent electrical lead connection a further connection to a current or voltage 
source, by way of example to the battery voltage Ub or to earth. 

As a result of the low output resistance parasitic resistances which may appear in 
accident situations only have a slight influence on this potential bearing on the 
independent electrical lead connection. Furthermore in another embodiment of the 
invention the switching of the battery voltage or earth connection provides the possibility 
of transferring through this independent electrical lead connection the drive energy for 
the electromechanical unit at least for an adjusting direction. 

In a further development of the invention the central control unit has at least one switch 
for switching at least two different potentials. These potentials are by way of example 
the said earth potential or the battery voltage potential. If on the other hand a digital 
evaluation of the potential is preferred then a logic level, for example a level of 5 volt can 
also be used as one of the two different potentials. By way of switching over the two 
potentials it avoids that in one time state a high-resistance output of the central control 
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device leads to an undefined potential at the independent electrical lead connection. 

In order to further increase the security of this safety systenn, In a particularly 
advantageous development of the invention for controlling the "blocking" state the control 
of the potential through the central control device and a control through the logic of the 
control device are logically AND-linked. The logic of the door control device is thereby 
for example a micro controller integrated in the door control device which can in turn be 
connected through one of the signal links to the central control device. Through this logic 
AND-link a safety redundancy is generated which further reduces the influence of 
parasitic resistances. Furthermore it can be checked when checking the input states of 
the logic AND-link whether the control device of the door and the central control device 
are in the normal operating mode. 

An advantageous development of this design of the invention proposes that for the logic 
AND-link the switch of the central control device and a switch of the logic of the door 
control device form a series connection. The switches are preferably mechanical 
switches, more particularly switch transistors which in turn have a control connection. A 
first sub-variation of this development of the invention proposes that both switches are 
connected together electrically directly. Alternatively this second sub variation of this 
development proposes that both switches are connected together through a further 
element more particularly through at least one connection of the power switch or power 
connection of the door control device. The potential for controlling the power switch is 
preferably switchable between the earth potential and a control potential which can be 
less than or equal to the battery potential. 

In order to achieve a further increase in the safety of this safety system in a further 
advantageous development of the invention in each local control device for controlling 
the electromechanical unit a preferably permanent plausibility check takes place in which 
the release potential of the independent electrical lead connection is only then switched 
up when the conditions "ignition ofT and "undisturbed signal connections" are met. 

A preferred embodiment of the invention proposes that the connections are a constituent 
part of a bus system. This bus system is preferably a CAN-bus system which enables a 
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link with the central control device and further devices of the motor vehicle. If at least a 
bi-directional link, for example that of a CAN-bus, is used then a transfer of status data is 
possible between the devices of the motor vehicle. In addition to the status data further 
information on an operating mode, for example an emergency operation during an 
accident situation or a defect in the devices and a normal operating mode can be 
transferred. Further developments of this embodiment additionally permit a transfer of 
diagnostic data through the CAN-bus system which register the updated reliability of 
individual elements of the safety system, more particularly the reliability of the potentials 
and the independent electrical lead connection to the central control device. 

A particularly advantageous development of the invention proposes that the control 
device has a micro controller. A constituent part of this micro controller is for example a 
logic which enables the logical AND-link to the control of the central device. Furthermore 
this micro controller serves to control and evaluate further operations of the function 
elements of the motor vehicle door. This micro controller is furthermore connected for 
control to the power switch through its control connection. For this an output PIN of the 
micro controller can be connected directly to a discrete power switch in the form of a 
power transistor or a relay. Alternatively an indirect switching is also possible through a 
further logic of the control device of the door or through a logic of the central control 
device. For controlling the relay the connection can advantageously be through a driver 
transistor for energizing the relay coil. As an alternative to the connection through lead 
elements of a plate it is possible to integrate the micro controller together with the power 
switch on a semi conductor chip as so-called smart power technology. 

In a further advantageous development of the invention it is proposed that the micro 
controller of the control device is in active connection with the independent electrical lead 
connection for evaluation. This active connection enables the detection of states and 
faulty functions of the lead connection or signals or potentials being transferred. These 
faulty functions can be evaluated by the control device or alternatively in an 
advantageous development of this form of the invention it is proposed that the micro 
controller of the control device transfers through one of the signal links a status of the 
potential of the control connection of the lead switch or the state of the electromechanical 
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unit to the central control device. In this case an evaluation of the detected states and 
functional abilities through the central control device is possible in that this evaluates all 
time changes detected by the control device and registers by means of a plausibility 
check any deviation from a normal operation and where applicable starts an emergency 
5 operation. In this emergency operation mode a release is now consequently changed by 
way of example to control the electromechanical unit in the "blocking" direction. 

In a further advantageous development of the invention a window lifter drive of the motor 
vehicle door can be released in the "closing" direction through the independent electrical 
lead connection. By means of this control of the window lifter states it is to be prevented 
that automatic closing is prevented in an emergency operating situation. If the critical 
state of the electromechanical unit is already reached and an unlocking is no longer 
possible then in an emergency operating case the window lifter drive is controlled so that 
automatic opening of the window pane for this emergency operation is possible. 

One method for securing this adjusting device of a motor vehicle can be used with 
particular advantage. For this for example it is possible to use the safety system 
previously outlined or a modified safety system. Advantageously for controlling a lock of 
the vehicle in the "blocking" (safe) state in a first method step the functional reliability of a 
central control device and its connections are evaluated. In order to determine the 
operating state of the vehicle a characteristic value is evaluated. This characteristic 
value is for example the switched state of the ignition of the vehicle, so that "blocking" of 
the vehicle is not to take place when the ignition is switched on. 

25 If the operating state of the vehicle for a "blocking" through the lock represents no danger 
for the occupants of the vehicle then a potential for controlling the lock is switched to an 
electrical lead connection which is independent of the signal links. A control command is 
transferred through one of the signal links of the central control device to a control 
device. If through the evaluation a fault-free functioning of the devices and the signal link 

30 is detected, then an electromechanical unit of the lock is energised through a power 
switch of the control device of the door and the lock is switched to the "blocking" state. 
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The invention will now be explained in further detail with reference to embodiments 
illustrated diagrammatically in the drawings. 

5 They show: 

Figure 1 a motor vehicle with communications structure; 

Figure 2 a block circuit diagram of a safety system; 

10 

Figure 3 a circuit plan of a safety system, and 

Figures 4a and 4b a flow chart of a safety process. 

15 Figure 1 shows diagrammatically a motor vehicle. For communication this motor vehicle 
has a central control device ZSG which can be controlled optically or by radio by means 
of a remote control RC, by way of example by a vehicle key. This central control device 
ZSG is connected through a bus system CAN to door control devices TSG 1 , TSG 2, 
TSG 3 and TSG 4. The door control devices TSG 1, TSG 2, TSG 3 and TSG 4 are 

20 disposed in the four doors of the motor vehicle. The connections of the bus 
communications structure CAN are laid in the vehicle doors from inside the vehicle 
through door partitions TSS 1, TSS 2, TSS 3 and TSS 4 and are connected there to the 
door control devices TSG 1 . TSG 2. TSG 3 and TSG 4. 

25 A block circuit diagram of the safety system is illustrated in Figure 2. Figure 2 shows by 
way of example a door control device TSG which is connected through an interface TSS 
to the central control device CSG as well as the battery of the vehicle Bat. An analogous 
structure is also produced for the other door control devices of the motor vehicle. The 
battery Bat has two connections B and GND for the battery voltage potential Ub and the 

30 earth connection GND. Both connections are connected both to the central control 
device ZSG and to the door control device TSG. The central control device ZSG has a 
micro controller ^C1 and a CAN- bus interface CAN. The CAN-bus interface CAN is 
connected through the CAN-bus CAN through the door partition TSS to the CAN-bus 
interface CAN of the door control device TSG. A further connection St which is 

35 independent of the CAN-bus exists between the central control device ZSG and the door 
control device TSG. For controlling the potential of the independent electrical control 
lead St the central control device has two potential switches PS1 and PS 2 whereby the 
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first potential switch PS1 is connected to the battery voltage potential Ub and to the 
control lead. The second potential switch PS 2 is however connected to the control lead 
St and to earth GND. 

The door control device TSG is apart from the link to the central control device through 
the CAN-bus system CAN and the independent electrical control lead St as well as the 
supply lead to the motor vehicle battery Bat also connected to further function units of the 
vehicle door. Two electromechanical adjusting drives M1 and M2 are connected to the 
door control device TSG which has power switches LSI and LS2 for energising the two 
drives M1 and M2. The first adjusting drive Ml is an adjusting drive of a vehicle lock 
wherein this adjusting drive M1 serves to lock and unlock the vehicle door. The second 
electromechanical drive M2 serves to switch the same lock into the "blocking" state, thus 
a so-called safe state. 

In order to energise this second adjusting drive by means of the second power switch 
LS2 this second power switch LS2 is connected by means of the control lead directly to 
the central control device. The second power switch as well as also the first power 
switch LS1 are formed as mechanical power switches in the form of relays or the like or 
as semi conductors full or semi-bridged. The power switches LS1 and LS2 have for this 
several control inputs (not shown in Figure 2). These control inputs are connected to the 
micro controller nC2 of the door control device TSG and control lead St or further input 
wiring. 

In order to move the lock into the "blocking" state it is first checked whether the safety 
system is in the normal operating mode. The central control device then switches the 
control lead St by means of the potential switch PS1 to the operating voltage potential of 
the battery Bat Ub. For this the second potential switch PS2 which has connected the 
control lead St previously to the earth is opened. As the next stage the central control 
device sends via the CAN-bus CAN a signal into the door control device TSG which 
contains a command to energise the second electromechanical drive unit M2. 



The circuit plan illustrated in Figure 3 shows a section of the more specific design 
Figure 2 . In Figure 3 the door partition TSS is shown with the connections from the 



wo 2004/020258 PCT/DE2003/002690 

11 

central control device ZSG to the door control device TSG which have been laid through 
the door partition TSS. The connection is thereby the control lead St. the battery 
voltages Ub as well as the earth connection GND. A CAN-bus system CAN is in turn 
provided for comnnunication between the door control device and the central control 
5 device. The door control device TSG is in turn connected to the lock Sch of a vehicle 
door through three current leads. The lock Sch of the vehicle door is mounted in a wet 
space N of the vehicle door and is suitably sealed against the penetration of damp. 

On the other hand the door control device TSG is mounted on the dry space side T of the 
10 vehicle door and has no adequate damp protection from the wet space. For 
communication between the door control device and the central control device through 
the CAN-bus CAN the micro controller \xC^ of the central control device ZSG and the 
micro controller of the door control device TSG are connected together through 
transceiver circuits Trans 1 and Trans 2 which provide suitable hardware for the CAN- 
15 bus control. Additionally the micro controller |iC1 of the central control device is 
connected with a control connection with a field effect transistor JFET which enables the 
battery voltage Ub to be switched to the control lead St. 

The micro controller }xC2 of the door control device TSG has three outputs which are 
20 each connected through resistances R1, R2 or R3 to driver transistors, in this case NPN 
bipolar transistors Q1, Q2 and Q3. The driver transistors Q1, Q2 and Q3 are each 
connected to a relay coil In1, In2 and InS of a relay RL1, RL2 and RL3 respectively, the 
driver transistors Q1, Q2 and Q3 thereby switch the connections of the relay coils In1, 
In2, In3 to earth. The relevant other connection of the relay coils Inl and In2 is 
25 connected to the battery voltage Ub, whilst the relay coil In3 is connected to the second 
connection to the control lead St. This third relay RL3 serves to energise the second 
electromechanical drive unit M2 of the lock Sch in the direction of the blocking state 
"Safe". 

30 In order to switch the lock into the blocking state the control lead must consequently be 
switched by the field effect transistor JFET of the central control device to battery voltage 
potential Ub and at the same time the driver transistor Q3 has to be switched through the 
micro controller |iC2 of the door control device TSG via the third resistance R3. 
Consequently as a condition to operate the lock in the "blocking" state, an AND-link is 

35 required of the output voltage of the micro controller |xC2 adjoining the driver transistor 
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Q3 with the switched field effect transistor JFET of the central control device ZSG. 

The relay switches S1, S2 and S3 are provided for the actual energising of the drive units 
M1 and M2 of the lock Sch. These relay switches are connected on the one hand to 
5 earth GND and on the other to the battery voltage Ub. The relay switches S3 of the third 
relay RL3 can be connected selectively to the battery voltage Ub or to the control lead St 
through a bridge, Jp a so-called jumper Jp. If the relay switch S3 is additionally 
connected to the control lead St then the second drive unit M2 of the lock Sch is 
energised through the control lead St. 

10 

Instead of the relays RL1 , RL2 and RL3 illustrated in Figure 3 it is also possible to use as 
an alternative power semi conductors which can also be integrated in the micro controller 
liC2 as smart power elements. If the semi conductor power switches are formed as 
discrete elements then their control is preferably counter-phased, in order to obtain with 
15 the appearance of a parasitic resistance a same-phased breakdown voltage on the 
control connections of the discrete power switches which does not cause any undesired 
switching through of the power transistors. This is particularly the case therefore since 
the parasitic resistances act the same on parallel mounted conductor paths which serve 
to control these discrete power switches. 

20 

Figures 4a and 4b show a procedure for securing a motor vehicle lock diagrammatically 
by means of a flow chart. In a first step the central control device ZSG receives the 
command "safe", thus to move the motor vehicle doors into the "blocking" state. This can 
be carried out by way of example through a remote control or the actuation of one of the 

25 locks by means of a vehicle key. In a second step it is checked whether the connections 
of the CAN-bus system function fault-free. For this the central control device can check 
for example at least the door control devices TSG of the motor vehicle doors for 
functioning ability. If a functioning ability of the CAN- bus connection is provided then in 
a third step the interrogation of a CAN value of the motor vehicle is carried out in this 

30 embodiment according to the state of the engine ignition. 

If in this third stage the engine ignition is switched on through the ignition key or the like 
then in a fourth step in Figure 4a the potential to an independent electrical lead 
connection St is switched off. Then in a fifth step a safe control command is sent to the 
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door control devices TSG from the central control device ZSG via the bus system CAN, 
If In the second step a fault has appeared in the CAN bus communication or the engine 
ignition is active then in a sixth step a fault is indicated through the safety system. Then 
in a seventh step the fault is protocolled in a file and made available for a later fault 
5 diagnosis. 

Figure 4b shows the second part of the safety method through the safety system which 
proceeds in the door control device TSG, Then after the fifth step of Figure 4a , thus the 
transfer of the safe control command through the CAN-bus to the door control device. 
10 the control potential of the control lead ST is checked in the door control device TSG 
through its micro controller ^C1. If the control potential corresponds to the potential for 
blocking the vehicle door, then in a ninth step a plausibility check of the overall system 
takes place in which for example the communications system as well as the functional 
ability of the door control device is checked. 

15 

If the plausibility check also produces a positive result then in the tenth method step the 
lock Sch is controlled into the blocking "safe" state. If in step eight the control potential is 
unsuitable for controlling the second electromechanical unit M2 in the blocking direction, 
then in step eleven a display is provided on the defective state of the central locking ZV. 

20 Similarly in the eleventh step the display of a defect in the central locking ZV takes place 
if the plausibility check of the ninth method step produces a negative result. In this case 
in addition to the display in the method step eleven the lock is controlled in a twelfth step 
in the unlocking direction in order to be able to ensure that any person who may be in the 
vehicle can leave the vehicle if the lock was not able to pass into the blocking (safe) 

25 state. 

Accordingly the detection of a fault triggers a display of a critical state in a vehicle display 
for the vehicle user and the door locks are controlled into the "unlocked" state. An end 
position in the "safe" region is consequently possible through the lock mechanism only 
30 via the intermediate position "locked" so that in the event of a fault two conditions have to 
be met in order to bring the vehicle door from the "unlocked" state into the "locked "state. 



wo 2004/020258 

LIST OF REFERENCE NUMERALS 



PCT/DE2003/002690 



ZSG 

5 TSG, TSG1,TSG2, 
TSG3, TSG4 
TSS, TSS1,TSS2. 
TSS3, TSS4 
CAN 
10 RC 
M1 
M2 

LS1, LS2 

^id, nC2 
15 St 

PS1, PS2 

Bat 

Ub 

GND 
20 Sch 

"safe" 

N 

T 

NT 

25 RI1,RI2. R13 
S1, S2, S3 
Inl, In2. In3 
Jp 

Q1, Q2, Q3 
30 R1,R2, R3 

Trans 1, Trans2 

JFET 

ZV 



Central control device 

Door control device 

Door partition 
CAN-bus 

Lock remote control 
Locking motor 
Blocking motor 

Power switch, power semi conductor 
Micro controller 
Control lead 

Switch, control switch, potential switch 
Battery 

Battery voltage 

Earth 

Lock 

Control lead for blocking 
Wet space 
Dry space 

Wet/dry space separation 
Relay 

Relay switch 
Relay coil 
Bridge, Jumper 
NPN Transistor 
Resistance 

Transceiver of CAN-bus 

Field effect transistor 

Central locking, central control of locks 



